Rice is a director. Sure, it's not a CxO, but directors wield significant influence over the path of a company. It's why they're called directors. As a director, she can use her influence to open channels for external surveillance (of course, using nicer terms than that). I don't mean "open a port on the firewall", I mean saying "hey, it's okay if org Foo gets this kind of data". This is the kind of strategic stuff that directors do. It doesn't matter how solid your sysadmins are if your directors hand over the keys to the castle.
And I guess we'll just have to disagree that her past experience has nothing to do with maintaining private data security.
Rice is not a direct member of the management team of Dropbox, and her past experience is not related at all to Dropbox's product.